Rietveld Code Review Tool
Help | Bug tracker | Discussion group | Source code

Side by Side Diff: include.preload.js

Issue 29347034: Issue 1727 - Prevent circumvention via WebSocket (Closed)
Patch Set: Go with simpler toString fix Created Aug. 10, 2016, 10:17 a.m.
Left:
Right:
Use n/p to move between diff chunks; N/P to move between comments.
Jump to:
View unified diff | Download patch
« no previous file with comments | « no previous file | lib/requestBlocker.js » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 /* 1 /*
2 * This file is part of Adblock Plus <https://adblockplus.org/>, 2 * This file is part of Adblock Plus <https://adblockplus.org/>,
3 * Copyright (C) 2006-2016 Eyeo GmbH 3 * Copyright (C) 2006-2016 Eyeo GmbH
4 * 4 *
5 * Adblock Plus is free software: you can redistribute it and/or modify 5 * Adblock Plus is free software: you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 3 as 6 * it under the terms of the GNU General Public License version 3 as
7 * published by the Free Software Foundation. 7 * published by the Free Software Foundation.
8 * 8 *
9 * Adblock Plus is distributed in the hope that it will be useful, 9 * Adblock Plus is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details. 12 * GNU General Public License for more details.
13 * 13 *
14 * You should have received a copy of the GNU General Public License 14 * You should have received a copy of the GNU General Public License
15 * along with Adblock Plus. If not, see <http://www.gnu.org/licenses/>. 15 * along with Adblock Plus. If not, see <http://www.gnu.org/licenses/>.
16 */ 16 */
17 17
18 var MutationObserver = window.MutationObserver || window.WebKitMutationObserver; 18 var MutationObserver = window.MutationObserver || window.WebKitMutationObserver;
19 var SELECTOR_GROUP_SIZE = 200; 19 var SELECTOR_GROUP_SIZE = 200;
20 var id = Math.random().toString(36).substr(2);
20 21
21 var typeMap = { 22 var typeMap = {
22 "img": "IMAGE", 23 "img": "IMAGE",
23 "input": "IMAGE", 24 "input": "IMAGE",
24 "picture": "IMAGE", 25 "picture": "IMAGE",
25 "audio": "MEDIA", 26 "audio": "MEDIA",
26 "video": "MEDIA", 27 "video": "MEDIA",
27 "frame": "SUBDOCUMENT", 28 "frame": "SUBDOCUMENT",
28 "iframe": "SUBDOCUMENT", 29 "iframe": "SUBDOCUMENT",
29 "object": "OBJECT", 30 "object": "OBJECT",
(...skipping 312 matching lines...) Expand 10 before | Expand all | Expand 10 after
342 var observer = new MutationObserver(function() 343 var observer = new MutationObserver(function()
343 { 344 {
344 if (style.parentNode != parentNode) 345 if (style.parentNode != parentNode)
345 parentNode.appendChild(style); 346 parentNode.appendChild(style);
346 }); 347 });
347 348
348 observer.observe(parentNode, {childList: true}); 349 observer.observe(parentNode, {childList: true});
349 return observer; 350 return observer;
350 } 351 }
351 352
353 function runInPage(fn, arg)
354 {
355 var script = document.createElement("script");
356 script.type = "application/javascript";
357 script.async = false;
358
359 // include.youtube.js passes this function a RegExp which JSON.stringify would
360 // convert to "{}".
361 if (!(arg instanceof RegExp))
Sebastian Noack 2016/08/10 12:22:45 Perhaps I got a better idea to avoid that special
kzar 2016/08/10 12:58:55 Done.
362 arg = JSON.stringify(arg);
363
364 script.textContent = "(" + fn + ")(" + arg + ");";
365 document.documentElement.appendChild(script);
366 document.documentElement.removeChild(script);
367 }
368
352 function protectStyleSheet(document, style) 369 function protectStyleSheet(document, style)
353 { 370 {
354 var id = Math.random().toString(36).substr(2)
355 style.id = id; 371 style.id = id;
356 372
357 var code = [ 373 runInPage(function(id)
358 "(function()", 374 {
359 "{", 375 var style = document.getElementById(id) ||
360 ' var style = document.getElementById("' + id + '") ||', 376 document.documentElement.shadowRoot.getElementById(id);
361 ' document.documentElement.shadowRoot.getElementById("' + id + '");', 377 style.removeAttribute("id");
362 ' style.removeAttribute("id");'
363 ];
364 378
365 var disableables = ["style", "style.sheet"]; 379 var disableables = [style, style.sheet];
366 for (var i = 0; i < disableables.length; i++) 380 for (var i = 0; i < disableables.length; i++)
381 Object.defineProperty(disableables[i], "disabled",
382 {value: false, enumerable: true});
383
384 ["deleteRule", "removeRule"].forEach(function(method)
385 {
386 var original = CSSStyleSheet.prototype[method];
387 CSSStyleSheet.prototype[method] = function(index)
388 {
389 if (this != style.sheet)
390 original.call(this, index);
391 };
392 });
393 }, id);
394 }
395
396 // Neither Chrome[1] nor Safari allow us to intercept WebSockets, and therefore
397 // some ad networks are misusing them as a way to serve adverts and circumvent
398 // us. As a workaround we wrap WebSocket, preventing blocked WebSocket
399 // connections from being opened.
400 // [1] - https://bugs.chromium.org/p/chromium/issues/detail?id=129353
401 function wrapWebSocket()
402 {
403 if (typeof WebSocket == "undefined")
404 return;
405
406 var eventName = "abpws-" + id;
407
408 document.addEventListener(eventName, function(event)
367 { 409 {
368 code.push(" Object.defineProperty(" + disableables[i] + ', "disabled", ' 410 ext.backgroundPage.sendMessage({
369 + "{value: false, enumerable: true});") ; 411 type: "websocket-request",
370 } 412 url: event.detail.url
413 }, function (block)
414 {
415 document.dispatchEvent(
416 new CustomEvent(eventName + "-" + event.detail.url, {detail: block})
417 );
418 });
419 });
371 420
372 var methods = ["deleteRule", "removeRule"]; 421 runInPage(function(eventName)
373 for (var j = 0; j < methods.length; j++)
374 { 422 {
375 var method = methods[j]; 423 // As far as possible we must track everything we use that could be
376 if (method in CSSStyleSheet.prototype) 424 // sabotaged by the website later in order to circumvent us.
425 var RealWebSocket = WebSocket;
426 var closeWebSocket = RealWebSocket.prototype.close;
427 var addEventListener = document.addEventListener.bind(document);
428 var removeEventListener = document.removeEventListener.bind(document);
429 var dispatchEvent = document.dispatchEvent.bind(document);
430 var CustomEvent = window.CustomEvent;
431 var boundCall = Function.prototype.call.bind(Function.prototype.call);
Sebastian Noack 2016/08/10 12:22:45 Since WebSocket.prototype.close is the only method
kzar 2016/08/10 12:58:55 Done.
432
433 function checkRequest(url, callback)
377 { 434 {
378 var origin = "CSSStyleSheet.prototype." + method; 435 var incomingEventName = eventName + "-" + url;
379 code.push(" var " + method + " = " + origin + ";", 436 function listener(event)
380 " " + origin + " = function(index)", 437 {
381 " {", 438 callback(event.detail);
382 " if (this != style.sheet)", 439 removeEventListener(incomingEventName, listener);
383 " " + method + ".call(this, index);", 440 }
384 " }"); 441 addEventListener(incomingEventName, listener);
442
443 dispatchEvent(new CustomEvent(eventName, {
444 detail: {url: url}
445 }));
385 } 446 }
386 }
387 447
388 code.push("})();"); 448 WebSocket = function WrappedWebSocket(url, protocols)
449 {
450 // Throw correct exceptions if the constructor is used improperly.
451 if (!(this instanceof WrappedWebSocket)) return RealWebSocket();
452 if (arguments.length < 1) return new RealWebSocket();
389 453
390 var script = document.createElement("script"); 454 var websocket = new RealWebSocket(url, protocols);
391 script.async = false; 455
392 script.textContent = code.join("\n"); 456 checkRequest(websocket.url, function(blocked)
393 document.documentElement.appendChild(script); 457 {
394 document.documentElement.removeChild(script); 458 if (blocked)
459 boundCall(closeWebSocket, websocket);
460 });
461
462 return websocket;
463 }.bind();
464
465 var properties = Object.getOwnPropertyNames(RealWebSocket);
466 for (var i = 0; i < properties.length; i++)
467 {
468 var name = properties[i];
469 var desc = Object.getOwnPropertyDescriptor(RealWebSocket, name);
470 Object.defineProperty(WebSocket, name, desc);
471 }
472
473 RealWebSocket.prototype.constructor = WebSocket;
474 }, eventName);
395 } 475 }
396 476
397 function init(document) 477 function init(document)
398 { 478 {
399 var shadow = null; 479 var shadow = null;
400 var style = null; 480 var style = null;
401 var observer = null; 481 var observer = null;
402 var tracer = null; 482 var tracer = null;
403 483
484 wrapWebSocket();
485
404 function getPropertyFilters(callback) 486 function getPropertyFilters(callback)
405 { 487 {
406 ext.backgroundPage.sendMessage({ 488 ext.backgroundPage.sendMessage({
407 type: "filters.get", 489 type: "filters.get",
408 what: "cssproperties" 490 what: "cssproperties"
409 }, callback); 491 }, callback);
410 } 492 }
411 var propertyFilters = new CSSPropertyFilters(window, getPropertyFilters, 493 var propertyFilters = new CSSPropertyFilters(window, getPropertyFilters,
412 addElemHideSelectors); 494 addElemHideSelectors);
413 495
(...skipping 150 matching lines...) Expand 10 before | Expand all | Expand 10 after
564 }, true); 646 }, true);
565 647
566 return updateStylesheet; 648 return updateStylesheet;
567 } 649 }
568 650
569 if (document instanceof HTMLDocument) 651 if (document instanceof HTMLDocument)
570 { 652 {
571 checkSitekey(); 653 checkSitekey();
572 window.updateStylesheet = init(document); 654 window.updateStylesheet = init(document);
573 } 655 }
OLDNEW
« no previous file with comments | « no previous file | lib/requestBlocker.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld